[FFmpeg-soc] [soc]: r5735 - mms/mmst.c

[spyfeng]

Author: spyfeng
Date: Wed Apr  7 18:27:52 2010
New Revision: 5735

Log:
check array bounds when copy data into it.

Modified:
   mms/mmst.c

Modified: mms/mmst.c
==============================================================================
--- mms/mmst.c	Sat Apr  3 19:29:38 2010	(r5734)
+++ mms/mmst.c	Wed Apr  7 18:27:52 2010	(r5735)
@@ -267,6 +267,11 @@ static MMSSCPacketType get_tcp_server_re
 
                     dprintf(NULL, "Length remaining is %d\n", length_remaining);
                     // read the rest of the packet.
+                    if (length_remaining > sizeof(mms->incoming_buffer) - 12) {
+                        dprintf("Incoming message len %d exceeds buffer len %d\n",
+                            length_remaining, sizeof(mms->incoming_buffer) - 12);
+                        break;
+                    }
                     read_result = url_read_complete(mms->mms_hd, mms->incoming_buffer + 12,
                                                   length_remaining) ;
                     if (read_result == length_remaining) {
@@ -297,6 +302,11 @@ static MMSSCPacketType get_tcp_server_re
                 mms->pkt_buf_len          = length_remaining;
                 mms->pkt_read_ptr         = mms->incoming_buffer;
 
+                if (length_remaining > sizeof(mms->incoming_buffer)) {
+                    dprintf("Incoming data len %d exceeds buffer len %d\n",
+                            length_remaining, sizeof(mms->incoming_buffer));
+                    break;
+                }
                 read_result= url_read_complete(mms->mms_hd, mms->incoming_buffer, length_remaining);
                 if(read_result != length_remaining) {
                     dprintf(NULL, "read_bytes result: %d asking for %d\n",